Security overhaul: consolidated hardening of the key-holding signer (consent UI, session-only key, NIP-44, NIP-98 replay fix, CI)

.eslintrc.json

@@ -0,0 +1,41 @@
+{
+  "root": true,
+  "env": {
+    "browser": true,
+    "webextensions": true,
+    "serviceworker": true,
+    "es2022": true
+  },
+  "parserOptions": {
+    "ecmaVersion": 2022,
+    "sourceType": "module"
+  },
+  "extends": "eslint:recommended",
+  "rules": {
+    "no-eval": "error",
+    "no-implied-eval": "error",
+    "no-undef": "error",
+    "no-unused-vars": [
+      "error",
+      {
+        "argsIgnorePattern": "^_",
+        "varsIgnorePattern": "^_",
+        "caughtErrorsIgnorePattern": "^_"
+      }
+    ]
+  },
+  "ignorePatterns": [
+    "node_modules/",
+    "dist/",
+    "**/*.bundle.js"
+  ],
+  "overrides": [
+    {
+      "files": ["test/**/*.js", "scripts/**/*.js"],
+      "env": {
+        "node": true,
+        "browser": false
+      }
+    }
+  ]
+}

.github/workflows/ci.yml

@@ -0,0 +1,47 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  build-test-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Test
+        run: npm test
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Package extension (sideloadable unpacked zip)
+        run: |
+          mkdir -p dist
+          zip -r dist/podkey-extension.zip manifest.json src popup $([ -d icons ] && echo icons) -x '*.test.js'
+
+      - name: Upload extension artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: podkey-extension
+          path: dist/podkey-extension.zip
+          if-no-files-found: error

CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to Podkey will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Added
+
+- **NIP-44 (v2) encryption** — `window.nostr.nip44.encrypt(pubkey, plaintext)`
+  and `window.nostr.nip44.decrypt(pubkey, ciphertext)`, enabling NIP-17 / NIP-59
+  gift-wrapped direct messages. Crypto runs in the background service worker
+  (the private key never reaches the page), reusing the existing message-passing
+  path. Implemented with `@noble/ciphers` (chacha20) + `@noble/hashes`
+  (hkdf/hmac/sha256) + `@noble/secp256k1` (ECDH). Verified against the official
+  NIP-44 spec test vectors.
+
 ## [0.0.7] - 2024-12-XX
 
 ### Changed

README.md

@@ -68,6 +68,7 @@
 - ✅ **Key Generation** - Secure cryptographic key generation using `@noble/secp256k1`
 - ✅ **Key Import** - Import existing 64-char hex private keys
 - ✅ **Event Signing** - Sign Nostr events with Schnorr signatures
+- ✅ **NIP-44 Encryption** - v2 `encrypt`/`decrypt` for NIP-17/NIP-59 gift-wrapped DMs (key never leaves the background)
 - ✅ **Trust Management** - Per-origin permissions with auto-approval
 - ✅ **Beautiful UI** - Soft gradients, smooth animations
 - ✅ **64-char Hex Keys** - Proper did:nostr format compatibility
@@ -261,6 +262,19 @@ const signed = await window.nostr.signEvent({
 })
 ```
 
+### `window.nostr.nip44.encrypt(pubkey, plaintext)` / `window.nostr.nip44.decrypt(pubkey, ciphertext)`
+
+NIP-44 (v2) encryption, used by NIP-17 / NIP-59 gift-wrapped direct messages.
+The private key never leaves the background service worker — encryption is
+performed there and only the resulting base64 payload (or decrypted plaintext)
+crosses to the page, mirroring the existing signing message path.
+
+```javascript
+const peer = '<64-char hex pubkey>'
+const payload = await window.nostr.nip44.encrypt(peer, 'hello')
+const plaintext = await window.nostr.nip44.decrypt(peer, payload)
+```
+
 ### `window.nostr.getRelays()`
 
 Returns relay configuration (coming soon).

package.json

@@ -8,7 +8,7 @@
     "dev": "echo 'Load extension from chrome://extensions in developer mode'",
     "build": "npm run bundle",
     "bundle": "node scripts/bundle.js",
-    "test": "node --test test/**/*.test.js",
+    "test": "node --test test/*.test.js",
     "lint": "eslint src/"
   },
   "keywords": [
@@ -34,6 +34,7 @@
   },
   "homepage": "https://github.com/JavaScriptSolidServer/podkey#readme",
   "dependencies": {
+    "@noble/ciphers": "^2.2.0",
     "@noble/hashes": "^1.3.3",
     "@noble/secp256k1": "^3.0.0"
   },
@@ -44,4 +45,4 @@
   "engines": {
     "node": ">=18.0.0"
   }
-}
+}